The 18 CIS Controls Explained: A Comprehensive Business Guide
The 18 CIS Critical Security Controls are a free, prioritized set of 153 cybersecurity safeguards published by the Center for Internet Security (CIS). They tell an organization exactly what to do first to stop the most common attacks. Every company, regardless of size, should start with Implementation Group 1 (IG1): the 56 safeguards CIS defines as essential cyber hygiene.
What are the 18 CIS Critical Security Controls?
The CIS Critical Security Controls (CIS Controls) are a consensus-built cybersecurity framework maintained by the Center for Internet Security, an independent nonprofit. The current version, CIS Controls v8.1, organizes 153 specific actions, called Safeguards, into 18 Controls that run from asset inventory to penetration testing. Each Safeguard is a concrete task a team can assign, complete, and verify.
That specificity is what separates the CIS Controls from outcome-based frameworks. NIST CSF 2.0 tells you to "protect" assets. CIS Safeguard 6.5 tells you to require multi-factor authentication (MFA) for administrative access. Executives get a framework they can track, and IT teams get a task list they can execute.
The framework has evolved with the threat landscape. Version 8, released in May 2021, consolidated the original 20 Controls into 18, organized them by activity rather than by who manages a device, and renamed Sub-Controls as Safeguards. Version 8.1, published in June 2024, kept the same 153 Safeguards but added a "Governance" security function to align with NIST Cybersecurity Framework (CSF) 2.0. CIS has said publicly that it is already developing ideas for Version 9.
The 18 CIS Controls at a glance
The table below translates each CIS Control into plain English and shows whether it contains any IG1 (essential hygiene) Safeguards. Controls 13, 16, and 18 have no IG1 Safeguards, which is why smaller organizations often address them later.
# | CIS Control | What it means in plain English | IG1? |
1 | Inventory and Control of Enterprise Assets | Know every laptop, server, VM, and cloud instance you own | Yes |
2 | Inventory and Control of Software Assets | Know every application and remove unsupported software | Yes |
3 | Data Protection | Know where sensitive data lives, who can reach it, and when it is destroyed | Yes |
4 | Secure Configuration of Enterprise Assets and Software | Replace insecure factory defaults with hardened settings | Yes |
5 | Account Management | Inventory accounts, require unique passwords, disable dormant accounts | Yes |
6 | Access Control Management | Grant and revoke access through a process, and require MFA | Yes |
7 | Continuous Vulnerability Management | Patch on a schedule and track every fix to closure | Yes |
8 | Audit Log Management | Collect and keep the logs you will need during an investigation | Yes |
9 | Email and Web Browser Protections | Filter the two channels attackers use most | Yes |
10 | Malware Defenses | Run anti-malware everywhere, updated automatically | Yes |
11 | Data Recovery | Keep automated, protected, isolated backups | Yes |
12 | Network Infrastructure Management | Keep firewalls, routers, and switches current and securely managed | Yes |
13 | Network Monitoring and Defense | Centralize alerts and detect intrusions | No (IG2+) |
14 | Security Awareness and Skills Training | Teach staff to recognize and report attacks | Yes |
15 | Service Provider Management | Inventory vendors and hold them to security terms | Yes |
16 | Application Software Security | Build and buy software securely | No (IG2+) |
17 | Incident Response Management | Named people, a reporting process, and practice | Yes |
18 | Penetration Testing | Prove your controls work by testing them like an attacker | No (IG2+) |
Which CIS Implementation Group should your company target?
CIS Implementation Groups (IGs) sort the 153 Safeguards into three cumulative tiers. IG1 contains 56 Safeguards for essential cyber hygiene. IG2 adds 74 more for organizations with dedicated IT staff and more sensitive data, for 130 total. IG3 adds the final 23 for organizations facing skilled, targeted attackers. CIS says every enterprise should start with IG1.
CIS describes the typical IG1 organization as a small or medium business with limited IT and security expertise, whose main concern is staying operational. That description fits most companies under a few hundred employees, but sector and data matter as much as headcount. A 20-person law firm holding privileged client files carries more risk than a 200-person distributor with no regulated data.
Purple Shield uses the following planning rule with clients. It is our practitioner guidance, not a CIS requirement:
If your organization is... | Target first | Why |
Under about 50 staff, outsourced IT, no regulated data | All of IG1, then the eight insurance-driven IG2 Safeguards described below | Highest risk reduction per dollar; keeps coverage insurable |
A healthcare practice, law firm, financial advisor, or any business handling PHI, privileged data, or card data | IG1 in year one plus selected IG2; full IG2 within 12 to 24 months | Regulators and clients expect documented, mature controls |
Mid-market (roughly 100 to 1,000 staff) with internal IT, multiple sites, or several cloud tenants | IG2 | Operational complexity outgrows IG1 quickly |
Enterprise, public company, critical infrastructure, or a software vendor to regulated customers | IG2 baseline, IG3 for crown-jewel systems | Targeted attackers and contractual security obligations |
Why do the CIS Controls?
The CIS Controls matter because they are measured against real attack data rather than opinion. The CIS Community Defense Model (CDM) v2.0 found that implementing IG1 alone defends against 77% of the MITRE ATT&CK techniques used across the top five attack types, and against 78% of ransomware techniques. Implementing every Safeguard defends against 86% of all techniques in the ATT&CK framework.
The five attack types CIS analyzed are malware, ransomware, web application hacking, insider and privilege misuse, and targeted intrusions. According to CIS, IG1 defends against 86% of web application hacking techniques and 83% of targeted intrusion techniques. For a business owner, the takeaway is practical: the cheapest tier of the framework covers most of how companies actually get breached.
Curtis Dukes, executive vice president at CIS, summarized the guidance this way when the model was released: enterprises "should aim to start with IG1 to obtain the highest value." In our experience, that advice is most often ignored by companies that have already bought advanced tools but never finished the basics underneath them.
What does the 2026 Verizon DBIR say about the CIS Controls?
The 2026 Verizon Data Breach Investigations Report (DBIR), which CIS has contributed to for 13 years, again recommends specific CIS Controls against the most common attacks. According to CIS’s summary of the report, vulnerability exploitation is now the leading initial access vector, and fundamental security practices remain the most effective defense despite attackers’ growing use of generative AI.
Attack pattern | 2026 DBIR finding (as reported by CIS) | CIS Controls that answer it |
Vulnerability exploitation | Now the leading initial access vector | 2 (Software Inventory), 7 (Vulnerability Management) |
Credential abuse | Present in the attack chain of 39% of breaches | 4 (Secure Configuration), 5 (Accounts), 6 (Access Control) |
Human element | Involved in 62% of all breaches | 14 (Security Awareness Training) |
Ransomware | On the rise; recovery capability decides whether you pay | 11 (Data Recovery) |
Third-party exposure | Breaches involving a third party rose 60% from the 2025 DBIR | 5, 6, and 15 (Service Provider Management) |
Privilege escalation | 83% of incidents did not involve exploiting a vulnerability | 4 plus CIS Benchmarks for secure configuration |
The pattern in that table is the real story. Most of the 2026 findings point to identity, configuration, and vendor access rather than exotic exploits. Those are areas where a company can make measurable progress in weeks, not years, by working through Controls 4, 5, 6, and 15.
Are the CIS Controls a legal standard for reasonable security?
In several U.S. states, the CIS Controls carry real legal weight. California’s Attorney General named them the minimum bar for "reasonable security" in 2016. Ohio, Utah, Connecticut, Iowa, Oklahoma, and Tennessee have since passed laws that let companies following a recognized framework, such as the CIS Controls, raise an affirmative defense in certain data breach lawsuits.
Why California businesses should pay closer attention
The California Attorney General’s 2016 Data Breach Report analyzed 657 breaches reported to the office between 2012 and 2015. Its first recommendation was that organizations meet the CIS Controls as a minimum level of security. The report went further, stating that failing to implement the Controls that apply to an organization’s environment "constitutes a lack of reasonable security." The report was not binding law, but law firms read it as a clear signal of how the office would evaluate companies after a breach.
A decade later, California has added a second reason to pay attention. The California Privacy Protection Agency (CPPA) cybersecurity audit regulations under the California Consumer Privacy Act (CCPA) took effect on January 1, 2026. Covered businesses must submit their first audit certifications by April 1, 2028 if they earned over $100 million, April 1, 2029 if they earned $50 million to $100 million, and April 1, 2030 if they earned under $50 million.
Here is the practitioner view. The CPPA rules do not require the CIS Controls by name, and an independent auditor will evaluate your program against the regulation itself. But a program mapped Safeguard by Safeguard to CIS, with dated evidence for each one, is far easier to audit than a collection of tools and policies. Companies that begin a CIS gap assessment now have two full budget cycles to close gaps before their first certification. This is general guidance, not legal advice; confirm applicability with your counsel.
Which states offer a safe harbor for following the CIS Controls?
Ohio enacted the first data security safe harbor law in 2018 and listed the CIS Critical Security Controls among the recognized frameworks. Utah and Connecticut followed in 2021, and Iowa, Oklahoma, and Tennessee passed their own versions by 2023. The scope differs by state; Oklahoma’s defense is narrower than Ohio’s, for example. The common thread is that a documented, framework-based program can turn a breach lawsuit from "you were negligent" into "we followed a recognized standard."
Do the CIS Controls satisfy cyber insurance requirements?
The CIS Controls satisfy most cyber insurance requirements, but IG1 alone usually falls short. In 2026, carriers gate coverage on MFA, endpoint detection and response (EDR), tested backups, an exercised incident response plan, patching, and email authentication. IG1 covers MFA, patching, and isolated backups well. CIS places restore testing, behavior-based malware defense, DMARC, and incident response exercises in IG2.
This gap is the single most useful thing a smaller company can learn about the framework. Many organizations assume "we did IG1" means "we are insurable," then hit a renewal questionnaire asking for restore-test logs and tabletop dates. Industry guidance published this year notes that missing MFA, EDR, or tested backups often means no quote at all, regardless of what else is in place.
What insurers expect in 2026 | Matching CIS Safeguard(s) | IG |
MFA on email, remote access, and admin accounts | 6.3, 6.4, 6.5 | IG1 |
Timely patching, no unsupported systems | 2.2, 7.3, 7.4 | IG1 |
Backups isolated from production | 11.2, 11.3, 11.4 | IG1 |
Security awareness training | 14.1 to 14.8 | IG1 |
Restore-tested backups | 11.5 Test Data Recovery | IG2 |
EDR with active monitoring | 10.7 Behavior-Based Anti-Malware, 13.1 Centralize Security Event Alerting | IG2 |
Written incident response plan, tested by tabletop | 17.4 IR Process, 17.7 IR Exercises | IG2 |
Email authentication (DMARC) | 9.5 Implement DMARC | IG2 |
Vendor risk management | 15.2 Provider Policy, 15.4 Security Terms in Contracts | IG2 |
Privileged access controls | 5.4 Dedicated Admin Accounts (IG1); 6.8 Role-Based Access (IG3) | Mixed |
Purple Shield calls the resulting target "IG1-plus": all 56 IG1 Safeguards plus eight IG2 Safeguards (9.5, 10.7, 11.5, 13.1, 15.2, 15.4, 17.4, and 17.7), for 64 in total. For most small and mid-sized businesses, that is the shortest path that both reduces real risk and survives an underwriting review. Carrier questionnaires vary, so always map your specific application line by line.
Evidence matters as much as the control itself. Underwriters increasingly ask for artifacts, such as an EDR deployment coverage report, an MFA enrollment percentage, and a dated restore-test log, rather than accepting a yes on a form. Building that evidence while you implement each Safeguard costs far less than reconstructing it the week before renewal.
How can a company implement CIS IG1 in 90 days?
A focused small or mid-sized company can usually reach IG1 in about 90 days by sequencing work by risk rather than by Control number. Purple Shield’s approach spends the first 30 days on visibility and the fastest risk reducers, the next 30 on hardening and patching, and the final 30 on proving controls work and packaging the evidence.
The numbering of the 18 Controls is not an implementation order. MFA (Control 6) and isolated backups (Control 11) belong in the first month because credential abuse and ransomware recovery are where 2026 losses concentrate. Most organizations already own the licenses needed for this phase through Microsoft 365 or Google Workspace.
Days 1 to 30: see everything and close the front doors
Build the enterprise asset and software inventories, and flag unsupported software (1.1, 1.2, 2.1, 2.2, 2.3).
Inventory every account and disable dormant ones (5.1, 5.3).
Enforce MFA on externally exposed applications, remote access, and admin accounts (6.3, 6.4, 6.5).
Confirm one isolated, protected copy of backups exists (11.2, 11.3, 11.4).
Name an incident lead, publish contact details, and define how staff report incidents (17.1, 17.2, 17.3).
List every service provider that holds your data or runs critical systems (15.1).
Days 31 to 60: harden, patch, and log
Apply secure configuration baselines, using the free CIS Benchmarks as the starting point, and remove default accounts (4.1 to 4.7).
Move administrators to dedicated admin accounts (5.4) and formalize access granting and revoking (6.1, 6.2).
Automate operating system and application patching with defined remediation timelines (7.1 to 7.4).
Confirm anti-malware coverage and DNS filtering on every endpoint (10.1 to 10.3, 9.1, 9.2).
Turn on audit log collection with adequate storage (8.1 to 8.3), and update network devices (12.1).
Build the data inventory and encrypt laptops and other end-user devices (3.1 to 3.3, 3.6).
Days 61 to 90: prove it, train people, and package the evidence
Launch security awareness training covering social engineering, authentication, data handling, and incident reporting (14.1 to 14.8).
Set data retention and secure disposal rules (3.4, 3.5).
Run a full restore test and record the result (11.5, IG2).
Hold a 90-minute incident response tabletop with leadership (17.7, IG2).
Publish DMARC for your email domains (9.5, IG2).
Assemble an evidence binder and a one-page board summary showing your IG1 score and IG2 roadmap.
CIS offers the CIS Controls Self Assessment Tool (CSAT) for tracking status Safeguard by Safeguard, and a spreadsheet works for smaller teams. What matters is that every Safeguard has an owner, a status, and a piece of evidence attached.
What do most companies get wrong about the CIS Controls?
The most common mistake is treating the CIS Controls as a shopping list. Organizations buy a tool mapped to each Control, then discover during an insurance renewal, an audit, or a breach that nobody can prove the Safeguards are working. The Controls reward process, ownership, and evidence far more than products.
Reading 1 to 18 as a sequence. Teams that start at Control 1 and march forward can spend a quarter perfecting asset discovery while admin accounts still lack MFA. Sequence by risk.
Declaring IG1 done without evidence. A policy that says "MFA is required" is not the same as an enrollment report showing 100% of users enrolled. Auditors and underwriters test the second.
Skipping governance. CIS Controls v8.1 added a Governance function for a reason. Every Safeguard needs a named owner and a review cadence, or it decays within a year.
Ignoring vendors. With third-party breaches up 60% in the 2026 DBIR, Control 15 is no longer optional for anyone who outsources IT, payroll, or cloud hosting.
Treating it as a one-time project. Assets, staff, and vendors change constantly. An annual reassessment keeps the program honest, and CIS Controls v9 will eventually shift the target again.
How does Purple Shield Security help with the CIS Controls?
Purple Shield Security runs vendor-neutral CIS Controls gap assessments led by a credentialed CISO. We score all 153 Safeguards against your target Implementation Group, map the gaps to your cyber insurance questionnaire and regulatory obligations, and deliver a prioritized 90-day roadmap. We do not resell tools or take vendor referral fees, so recommendations are never tied to a product.
A typical engagement delivers:
A Safeguard-by-Safeguard scorecard against IG1, IG2, or IG3, with evidence gaps called out.
An insurance crosswalk showing which questionnaire answers you can support today.
A regulatory crosswalk to HIPAA, PCI DSS, NIST CSF 2.0, and the CCPA cybersecurity audit rules, as applicable.
A 90-day remediation roadmap with owners, sequencing, and budget ranges.
A board-ready summary written for executives, not engineers.
Optional vCISO support to drive remediation, plus scoping and oversight for Control 18 penetration testing.
Frequently asked questions
Are the CIS Controls free to use?
Yes. CIS publishes the CIS Controls, the Implementation Group guidance, and the CIS Benchmarks as free downloads after registration. Paid CIS SecureSuite membership adds hosted assessment tools. Note that the MS-ISAC, which supports state and local governments, moved to fee-based membership on June 23, 2025.
Is there an official CIS Controls certification for companies?
CIS does not issue an organizational certification comparable to an ISO 27001 certificate. Companies demonstrate alignment through an independent assessment, a documented Safeguard-by-Safeguard scorecard, and dated evidence. That evidence package is what insurers, auditors, and enterprise customers actually review.
What is the difference between the CIS Controls and NIST CSF 2.0?
NIST CSF 2.0 is outcome-based and organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The CIS Controls are prescriptive and tell you which specific actions to take. CIS published an official mapping from v8.1 to NIST CSF 2.0 in June 2024, so many organizations use CSF for governance and board reporting and the CIS Controls for day-to-day execution.
Do the CIS Controls apply to cloud and Microsoft 365 environments?
Yes. Version 8 was rewritten for cloud, mobile, and remote work, and CIS released a Cloud Companion Guide for v8.1 on December 9, 2024. The CIS Benchmarks add secure configuration guidance for more than 150 technologies, including major cloud platforms and productivity suites.
How many CIS Safeguards does a small business really need?
Start with the 56 IG1 Safeguards, which CIS defines as the minimum for every enterprise. If you buy or renew cyber insurance, add the eight IG2 Safeguards insurers commonly test: 9.5, 10.7, 11.5, 13.1, 15.2, 15.4, 17.4, and 17.7. That 64-Safeguard target is the practical floor for most small businesses in 2026.
If you want to know where you stand against all 18 CIS Controls before your next insurance renewal, audit, or board meeting, Purple Shield Security can run a CIS Controls gap assessment and hand you a prioritized 90-day plan. Reach out through purpleshieldsecurity.com to start the conversation.
